CVE-2026-44290: DoS in protobufjs ≤7.5.5
Platform
nodejs
Component
protobufjs
CVE-2026-44290 describes a Denial of Service (DoS) vulnerability affecting protobufjs versions up to 7.5.5. This vulnerability arises from improper handling of schema option paths, allowing attackers to corrupt process-wide JavaScript constructors. Successful exploitation can lead to a persistent denial of service, impacting the application's functionality and potentially affecting other processes.
Impact and Attack Scenarios
The core of this vulnerability lies in protobufjs's option handling mechanism. When processing protobuf schemas or JSON descriptors, the parser incorrectly traverses inherited object properties. A malicious actor can craft a schema or descriptor that exploits this flaw, causing the parser to write to properties on global JavaScript constructors, such as Object, Array, or String. This corruption effectively breaks the fundamental building blocks of the JavaScript runtime, leading to unpredictable behavior and application crashes. The impact is persistent; the corruption remains until the process is restarted, resulting in a prolonged denial of service. This differs from transient DoS attacks as it requires no ongoing exploitation.
Exploitation Context
CVE-2026-44290 was published on 2026-05-12. The vulnerability's severity is rated as HIGH (CVSS 7.5). Currently, there are no publicly available Proof-of-Concept (POC) exploits. The vulnerability is not listed on KEV or EPSS, indicating a low to medium probability of active exploitation at this time. Monitor security advisories and threat intelligence feeds for any updates regarding exploitation attempts.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-44290 is to upgrade to a patched version of protobufjs. While a specific fixed version is not yet available, monitoring the project's release notes is crucial. In the interim, implement strict schema validation to prevent the parsing of untrusted or potentially malicious protobuf schemas and JSON descriptors. This can involve whitelisting allowed schema structures or using a schema validation library. Consider implementing a Web Application Firewall (WAF) or proxy to inspect and filter incoming protobuf data, blocking requests containing suspicious schema constructs. Carefully review any third-party libraries or components that utilize protobufjs and ensure they are not vulnerable to this issue.
How to fix
No official patch available. Check for workarounds or monitor for updates.
Frequently asked questions
What is CVE-2026-44290 — DoS in protobufjs?
CVE-2026-44290 is a high-severity Denial of Service vulnerability in protobufjs versions up to 7.5.5. A crafted protobuf schema can corrupt JavaScript constructors, leading to application crashes and a persistent denial of service.
Am I affected by CVE-2026-44290 in protobufjs?
You are affected if you are using protobufjs versions 7.5.5 or earlier. Review your project dependencies to determine if you are using a vulnerable version.
How do I fix CVE-2026-44290 in protobufjs?
Upgrade to a patched version of protobufjs as soon as it becomes available. In the meantime, implement strict schema validation and consider WAF rules to filter malicious protobuf data.
Is CVE-2026-44290 being actively exploited?
Currently, there are no publicly known exploits or reports of active exploitation. However, the vulnerability's severity warrants immediate attention and mitigation.
Where can I find the official protobufjs advisory for CVE-2026-44290?
Refer to the protobufjs project's official website and GitHub repository for updates and advisories related to CVE-2026-44290: https://protobufjs.org/
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...